News

Another Zero-Day Java Flaw Discovered

For the second time in less than a month, researchers have discovered a "critical" zero-day issue with Oracle's Java plugin.

Adam Gowdiak, CEO of security firm Security Explorations, discovered the flaw that can be exploited to bypass Java's security sandbox. Once leveraged, malware can be remotely installed on a targeted machine.

"The impact of this issue is critical -- we were able to successfully exploit it and achieve a complete Java security sandbox bypass in the environment of Java SE 5, 6 and 7," wrote Gowdiak in a Full Disclosure security newsletter.

He also commented that anyone running the Java plugin is vulnerable to attack, no matter what OS or Web browser used, and that Oracle needs to move quickly to fix the situation.

"We hope that a news about one billion users of Oracle Java SE software [3] being vulnerable to yet another security flaw is not gonna spoil the taste of Larry Ellison's [4] morning...Java," wrote Gowdiak.

Gowdiak's security team tested the vulnerability and was able to leverage the flaw it on both Windows- and Mac-based machines. Exploitation was also successful using Firefox 15.0, Google Chrome 21.0, Internet Explorer 9, Opera 12.02 and Safari 5.1 Web browsers.   

Specific details on the vulnerability have been forwarded to Oracle by the security team.

The Security Explorations team was also responsible for finding a flaw in Java Version 7 Update 7 earlier this month. The vulnerability, which was found one day after the release of the out-of-band update, also could be leveraged by bypassing the security features in Java's security sandbox. Gowdiak also said that he had reported 30 vulnerabilities earlier that year to Java -- with many still unfixed.

Oracle has remained quiet on the disclosure of the new vulnerability, and it is unclear whether a fix will come in the form of an out-of-band patch or be part of Oracle's quarterly Java update, scheduled for Oct. 16.

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Exchange Server June Cumulative Updates Arrive, but with Red Tape

    Microsoft released its quarterly cumulative updates (CUs) for Exchange Server 2013, 2016 and 2019 products this week, but added an extra step for IT pros to consider before installing them.

  • Moving an Old VM to a New Hyper-V Host

    So you want to know whether a Hyper-V virtual machine built on a legacy host will be supported by a newer server? There's a PowerShell command for that.

  • AI-Driven Solution Tracks Packets Through the Datacenter

    Datacenter solutions vendor Kaloom this week unveiled a new offering the company says will enable the development of "self-driving" datacenter networks.

  • Microsoft Previews Azure Bastion Service for Private VM Access

    Microsoft on Tuesday announced a preview of the Azure Bastion service, which lets a user connect to an Azure virtual machine (VM) using a private Internet connection.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.